Hey! im a brand new user on this forum, just wondering if any one could give me any help/advice!!
I have had fake adverts that get through my firewall asking if i would like to apply for a loan, asking me to register at adult sites(known as sex-world or something)ECT, or FAKE windows error messages trying to get me to download fake anti virus programmes ect...
i also recently got a weird background saying your infected please download this software. Also i deleted a programme called my sex world registration found in my add/remove programmes.
this is a family computer and needs to be used alot, but it has got so slow, it is almost un-usable, especially with the popups.(By the way im usuing XP sp2, if thats helpull?)
PLEASE can any one give me any more help on what to do now!!
many thanks for taking the time to read the post!
I ran combo fx , and here is my log:
ComboFix 08-07-02.5 - Liam 2008-07-03 12:52:19.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.208 [GMT 1:00]
Running from: C:\Documents and Settings\Liam\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Liam\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\InternetGameBox.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Privacy Policy.url
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Terms and Conditions.url
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Uninstall.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\InternetGameBox\Website.url
C:\Documents and Settings\Liam\Local Settings\Application Data\gaakamy.dat
C:\Documents and Settings\Liam\Local Settings\Application Data\gaakamy.exe
C:\Documents and Settings\Liam\Local Settings\Application Data\gaakamy_nav.dat
C:\Documents and Settings\Liam\Local Settings\Application Data\gaakamy_navps.dat
C:\WINDOWS\system32\_000003_.tmp.dll
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\_000013_.tmp.dll
C:\WINDOWS\system32\_000111_.tmp.dll
C:\WINDOWS\system32\my sex world.ico
C:\WINDOWS\system32\u2g.f
C:\WINDOWS\system32\winiconmon.ico
C:\WINDOWS\system32\winiconmon.ico.bak0
C:\WINDOWS\Web\def.htm
.
((((((((((((((((((((((((( Files Created from 2008-06-03 to 2008-07-03 )))))))))))))))))))))))))))))))
.
2008-07-03 00:11 . 2008-07-03 00:11 <DIR> d-------- C:\Documents and Settings\Liam\Application Data\Malwarebytes
2008-07-03 00:10 . 2008-07-03 00:10 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-03 00:10 . 2008-07-03 00:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-03 00:10 . 2008-06-28 14:16 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-03 00:10 . 2008-06-28 14:16 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-02 20:55 . 2008-07-02 20:55 <DIR> d-------- C:\Documents and Settings\Liam\white noise
2008-06-25 21:12 . 2008-06-25 21:12 268 --ah----- C:\sqmdata03.sqm
2008-06-25 21:12 . 2008-06-25 21:12 244 --ah----- C:\sqmnoopt03.sqm
2008-06-16 21:11 . 2008-06-16 21:11 <DIR> d--hs---- C:\FOUND.079
2008-06-15 21:41 . 2006-02-20 17:59 94,064 -ra------ C:\WINDOWS\system32\drivers\w810mdm.sys
2008-06-15 21:41 . 2006-02-20 17:59 85,408 -ra------ C:\WINDOWS\system32\drivers\w810mgmt.sys
2008-06-15 21:41 . 2006-02-20 17:59 83,344 -ra------ C:\WINDOWS\system32\drivers\w810obex.sys
2008-06-15 21:41 . 2006-02-20 17:59 8,336 -ra------ C:\WINDOWS\system32\drivers\w810mdfl.sys
2008-06-15 21:41 . 2006-02-20 17:59 6,176 -ra------ C:\WINDOWS\system32\drivers\w810cmnt.sys
2008-06-15 21:41 . 2006-02-20 17:59 6,176 -ra------ C:\WINDOWS\system32\drivers\w810cm.sys
2008-06-15 21:40 . 2006-02-20 17:59 58,288 -ra------ C:\WINDOWS\system32\drivers\w810bus.sys
2008-06-15 21:40 . 2006-02-20 17:59 5,808 -ra------ C:\WINDOWS\system32\drivers\w810whnt.sys
2008-06-15 21:40 . 2006-02-20 17:59 5,808 -ra------ C:\WINDOWS\system32\drivers\w810wh.sys
2008-06-12 18:34 . 2008-06-12 18:34 <DIR> d--hs---- C:\FOUND.078
2008-06-10 20:40 . 2008-06-13 14:10 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-31 14:20 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-05-31 14:20 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2008-05-31 14:20 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-05-31 14:20 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-05-11 22:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logishrd
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\RMCast.sys
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-23 21:16 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-22 07:40 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-04-22 07:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-04-20 05:07 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-02-26 14:15 5,914,648 ----a-w C:\Program Files\SUPERAntiSpyware.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"\\Darren\EPSON Stylus Photo R340 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAJE.EXE" [2006-12-26 05:00 177664]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 20:17 68856]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-07-02 14:26 1506544]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22 7700480]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-07-18 01:54 116072]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-04-22 17:51 1236992]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17 159744]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-01-17 22:03 282624]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832]
"nwiz"="nwiz.exe" [2006-10-22 12:22 1622016 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-07-02 14:26 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service
R3 Tunx00;FunTV Video Capture;C:\WINDOWS\system32\DRIVERS\Tunx00.sys [2004-08-13 06:57]
R3 TxTuner;FunTV TV Tuner;C:\WINDOWS\system32\DRIVERS\TxTuner.sys [2004-08-13 07:33]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
S3 Vsp;Vsp;C:\WINDOWS\System32\drivers\Vsp.sys [2003-05-27 16:45]
S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 09:42]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 09:42]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 09:42]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 09:42]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 09:42]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c5ef5b10-b5ce-11db-a483-00134697caa0}]
\Shell\AutoRun\command - F:\setupSNK.exe
*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2007-01-15 10:17:38 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job"
- c:\Program Files\Microsoft IntelliType Pro\itype.exe
"2008-05-30 19:00:02 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Liam.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK:
"2008-07-03 11:22:02 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-emboltrc - C:\WINDOWS\system32\nshodank.exe
SSODL-KbdAlrt-{96120215-57e7-482a-b5da-25f34e6f17d3} - C:\WINDOWS\Resources\KbdAlrt.dll
Notify-hgGwWnmK - hgGwWnmK.dll
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-03 12:56:51
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\\\\Darren\\EPSON Stylus Photo R340 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAJE.EXE /FU \"C:\\WINDOWS\\TEMP\\E_SDA.tmp\" /EF \"HKCU\""
.
Completion time: 2008-07-03 12:58:24
ComboFix-quarantined-files.txt 2008-07-03 11:58:16
Pre-Run: 134,210,813,952 bytes free
Post-Run: 134,318,325,760 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
169 --- E O F --- 2008-06-20 20:24:07